Google Docs Phishing Scam Affects Over a Million People; Experts Say Attack May Happen Again

This week, Google has since acknowledged a malicious campaign involving its users and a Google Docs link. The campaign, Reuters said, involves a “novel approach to phishing,” wherein users are asked to click on a Google Docs link to grant access.

On Wednesday, users have been tweeting about the malicious campaign, which reportedly came from the email address [email protected], but is listed as one of the listed contacts in a targeted user’s address book. According to the Electronic Frontier Foundation, the hacker or hackers would gain access to the victim’s emails and email contacts, and would be able to send and delete emails.

A spokesperson said in a statement that over a million people were affected with the campaign, explaining, “We have taken action to protect users against an email spam campaign impersonating Google Docs, which affected fewer than 0.1% of Gmail users. We were able to stop the campaign within approximately one hour.”

As of February 2016, Gmail has 1 billion active users every month, and will no doubt continue increasing.

Although Google promised that it has managed to stop the campaign, experts are saying that the security attack might happen nonetheless. Tom’s Guide said the attack would happen to other online services, for one, because of the use of the OAuth or open authorization protocol, a login mechanism which Google, Facebook, Twitter and many other services use to allow users to log into multiple websites at once. The mechanism also keeps users logged in for an indefinite period of time.